How many CVEs have a located fix in opencontainers/runc?

16 published CVEs have a fix traced to functions in opencontainers/runc, touching 96 functions across 37 files.

Which function in opencontainers/runc has been patched by the most CVEs?

mountToRootfs in libcontainer/rootfs_linux.go has been changed by 6 CVE fixes, from 2019 to 2025.

How large is a typical CVE fix in opencontainers/runc?

The median fix changes 129 lines. 19% of fixes change 20 lines or fewer, and 25% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

c

#350 of 500 repositories

opencontainers/runc

Name: opencontainers/runc: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix November 6, 2025

16

CVE fixes located

Published CVEs

96

Functions patched

Distinct function sites

37

Files patched

Distinct source files

2016–2025

Years covered

By CVE publication date

Overview

16 published CVEs have a fix traced to functions in opencontainers/runc, the earliest published in 2016. Those fixes changed 96 distinct functions across 37 files, in 331 patch hunks.

Among the 500 repositories tracked here, opencontainers/runc ranks #350 by the number of CVEs with a located fix.

Most patched functions

Functions in opencontainers/runc changed by the most CVE fixes.

Most patched files

Files in opencontainers/runc changed by the most CVE fixes.

1libcontainer/rootfs_linux.go9 CVEs · 23 functions
2libcontainer/init_linux.go5 CVEs · 8 functions
3libcontainer/container_linux.go5 CVEs · 5 functions
4libcontainer/standard_init_linux.go5 CVEs · 2 functions
5libcontainer/utils/utils_unix.go4 CVEs · 7 functions
6libcontainer/criu_linux.go3 CVEs · 4 functions
7internal/sys/verify_inode_unix.go3 CVEs · 1 functions
8internal/sys/doc.go3 CVEs · 0 functions
9internal/linux/linux.go2 CVEs · 2 functions
10libcontainer/nsenter/nsexec.c2 CVEs · 2 functions

Fix size

How much code a CVE fix in opencontainers/runc changes, with backports counted once.

129

Median lines changed

Added plus removed, per CVE

19%

Fixes of 20 lines or fewer

Share of CVE fixes

25%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in opencontainers/runc, and the functions each fix changed.

runc: LSM labels can be bypassed with malicious config using dummy procfs files
CVE-2025-52881createMountpoint Close procOpenReopen
High · CVSS 7.3
EPSS 0.6%2025-11-06
container escape due to /dev/console mount and related races
CVE-2025-52565Close mountConsole GetPtyPeer
High · CVSS 8.4
EPSS 0.6%2025-11-06
runc container escape via "masked path" abuse due to mount race conditions
CVE-2025-31133isDevNull closer VerifyInodeFunc
High · CVSS 7.3
EPSS 0.8%2025-11-06
runc can be confused to create empty files/directories on the host
CVE-2024-45310IsLexicallyInRoot createMountpoint prepareAt
Medium · CVSS 4.8
EPSS 0.3%2024-09-03
Cri-o: arbitrary command injection via pod annotation
CVE-2024-3154
High · CVSS 7.2
EPSS 1.4%2024-04-26
runc container breakout through process.cwd trickery and leaked fds
CVE-2024-21626CloseExecFrom Init verifyCwd
High · CVSS 8.4
EPSS 18.9%2024-01-31
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
CVE-2023-25809mountCgroupV2
Medium · CVSS 6.3
EPSS 0.3%2023-03-29
AppArmor bypass with symlinked /proc in runc
CVE-2023-28642mountToRootfs
High · CVSS 7.8
EPSS 0.3%2023-03-29
Incorrect Default Permissions in runc
CVE-2022-29162Example getProcess
High · CVSS 7.8
EPSS 0.4%2022-05-17
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration
CVE-2021-43784netlinkError Serialize bootstrapData
Medium · CVSS 6.0
EPSS 1.8%2021-12-06
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs
CVE-2021-30465mountCgroupV2 remount stripRoot
High · CVSS 8.5
EPSS 6.6%2021-05-27
opencontainers runc contains procfs race condition with a shared volume mount
CVE-2019-19921mountToRootfs
High · CVSS 7.0
EPSS 0.4%2020-02-12

Get an alert for each new opencontainers/runc CVE, with the patched functions and AI-written analysis.

Monitor runc CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Alinto/sogo16 CVEs android.googlesource.com/platform-system-bt16 CVEs argoproj/argo-workflows16 CVEs codeigniter4/CodeIgniter416 CVEs debian/libmatio16 CVEs debian/libvncserver16 CVEs debian/netatalk16 CVEs debian/nss16 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in opencontainers/runc.

How many CVEs have a located fix in opencontainers/runc?: 16 published CVEs have a fix traced to functions in opencontainers/runc, touching 96 functions across 37 files.
Which function in opencontainers/runc has been patched by the most CVEs?: mountToRootfs in libcontainer/rootfs_linux.go has been changed by 6 CVE fixes, from 2019 to 2025.
How large is a typical CVE fix in opencontainers/runc?: The median fix changes 129 lines. 19% of fixes change 20 lines or fewer, and 25% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track opencontainers/runc CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing